prole/docs/plans/junie/15-remove-dead-dashboard-consumer.md

# Junie brief — Queue #15: remove dead `DASHBOARD` consumer + `basicauth_credentials` from supabase Kong chart

> **Self-contained brief.** Pure cleanup. The basic-auth plugin block was
> removed in commit [`25f1b2e`](#) (oauth2-proxy → Kong fronting); the
> consumer + credentials it gated have no enforcer. **Watch the OpenAI key
> trap** — it lives in the same `secret.dashboard` block in
> `values.yaml`, so don't blanket-delete the section.

---

## 1. Why

Before commit [`25f1b2e`](#) (2026-04-30, oauth2-proxy fronting), Studio
was gated by Kong's `basic-auth` plugin against credentials in
`secret.dashboard.{username,password}`. That gate was replaced by
oauth2-proxy + Google OAuth, so the `basic-auth` plugin reference was
removed from the Kong route definition.

Three artifacts of the old gate remain:

1. **Kong consumer named `DASHBOARD`** in
   `supabase/helm/knoe-supabase/templates/kong/config.yaml` — has no
   plugin enforcing it. Dead.
2. **`basicauth_credentials` block** in the same file — provides
   credentials for a consumer no plugin is checking. Dead.
3. **`DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD` env vars** flowing through
   the Kong deployment + the wrapper-script's envsubst. Dead.

The `secret.dashboard.{username,password}` values in `values.yaml`
themselves are unused after this cleanup, but the **`secret.dashboard.openAiApiKey`
field is NOT dead** — it's consumed by
`templates/studio/deployment.yaml:92` to populate `OPENAI_API_KEY` in the
Studio pod env. **Don't delete the whole `secret.dashboard` block.**
Restructure carefully so the OpenAI key still has a home.

## 2. The four artifacts to remove

### Artifact 1 — `supabase/helm/knoe-supabase/templates/kong/config.yaml`

**Lines 19-20** (the wrapper-script's sed replacements):
```yaml
    -e "s|\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|" \
    -e "s|\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|" \
```
Delete both lines.

**Lines 30-32** (the consumer):
```yaml
    {{- if .Values.secret.dashboard }}
      - username: DASHBOARD
    {{- end }}
```
Delete all three lines (the `if`-end pair around the consumer).

**Lines 44-49** (the credentials block):
```yaml
    {{- if .Values.secret.dashboard }}
    basicauth_credentials:
      - consumer: DASHBOARD
        username: ${DASHBOARD_USERNAME}
        password: ${DASHBOARD_PASSWORD}
    {{- end }}
```
Delete all six lines.

### Artifact 2 — `supabase/helm/knoe-supabase/templates/kong/deployment.yaml`

**Lines 74-92** (the two env-var blocks): both `DASHBOARD_USERNAME` and
`DASHBOARD_PASSWORD` env-from-secret references. They're both wrapped in
`{{- if .Values.secret.dashboard }} ... {{- end }}`. Delete the whole
conditional block (both env vars, the wrapper, the inner conditional for
`secretRef` vs default secret).

After deletion, verify the surrounding env list still parses (Kong
deployment manifest must still be a valid Pod spec).

### Artifact 3 — `supabase/helm/knoe-supabase/values.yaml`

**Lines 104-118** (the `secret.dashboard` section):

```yaml
  ## Studio dashboard credentials
  ##
  dashboard:
    username: "supabase"
    password: "this_password_is_insecure_and_should_be_updated"
    openAiApiKey: "key_super_secret"
    ## Reference to existing secret
    # secretRef: ""
    ## Map to actual keys inside secretRef if they differ
    # secretRefKey:
    #   username: username
    #   password: password
    #   openAiApiKey: openAiApiKey
```

**Restructure** — don't delete. Two paths:

**Path A (recommended): rename the section to `openai`.** Remove
`username`/`password`. Rename `dashboard:` to `openai:`. Update the one
consumer (`templates/studio/deployment.yaml:92`) to read from
`.Values.secret.openai.apiKey` (renamed from `openAiApiKey`). Update the
secretRefKey mapping similarly. Cleanest.

```yaml
  ## OpenAI API key — passed to Studio's AI Assist sidebar.
  ## Optional; if absent, the AI Assist panel renders an error toast but
  ## the rest of Studio works fine. We default to a placeholder string so
  ## helm template doesn't fail; replace via secretRef in production.
  openai:
    apiKey: "key_super_secret"
    # secretRef: ""
    # secretRefKey:
    #   apiKey: apiKey
```

**Path B (minimal): drop username/password only.** Keep the section name
`dashboard:` since renaming touches more files. End up with a `dashboard:`
section that holds only `openAiApiKey`. Slightly confusing name vs.
contents, but the diff is smaller.

Pick Path A unless the touch surface scares you. The `if .Values.secret.dashboard`
conditional in the kong-deployment env block goes away in Path A
naturally; in Path B, replace those `if`s with explicit
`if .Values.secret.dashboard.username` / `.password` checks before
removing the env vars (since the block-level check used to mean "any
field set"; now it must be field-specific).

### Artifact 4 — `supabase/helm/knoe-supabase/templates/studio/deployment.yaml`

If you take Path A above, update the env-var binding at line 92:

```yaml
            - name: OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  {{- if .Values.secret.openai.secretRef }}
                  name: {{ .Values.secret.openai.secretRef }}
                  key: {{ .Values.secret.openai.secretRefKey.apiKey | default "apiKey" }}
                  {{- else }}
                  name: {{ include "supabase.secret.openai" . }}
                  key: apiKey
                  {{- end }}
```

(rename `dashboard` → `openai`, `openAiApiKey` → `apiKey`).

Also rename or re-source the helper template `supabase.secret.dashboard`
(if it exists in `_helpers.tpl`) to `supabase.secret.openai`. If the
helper doesn't exist (the grep earlier returned no match), skip.

### Artifact 5 — `supabase/helm/knoe-supabase/ci/example.yaml`

Has a parallel `secret.dashboard.openAiApiKey` for chart CI. Update to
match Path A or B.

## 3. Don't break

- **OpenAI API key flow**: pre-and-post-cleanup the Studio pod must
  receive `OPENAI_API_KEY` from a Secret, identically. Verify with
  `helm template` before vs. after.
- **Existing live deployments using `secretRef`** — if any production
  deploy uses `secret.dashboard.secretRef` to point at an existing K8s
  Secret with `username`/`password`/`openAiApiKey` keys, that secret
  needs renaming too. Grep for `secret.dashboard.secretRef` in any
  real values overrides (not just the chart defaults). If found,
  ASK before proceeding.

## 4. Verification

1. **`helm template` the chart and diff for OPENAI_API_KEY:**
   ```bash
   helm template supabase/helm/knoe-supabase \
     | grep -A 6 'name: OPENAI_API_KEY'
   ```
   Expected: env var still binds to a Secret. The Secret name + key may
   differ from before (if you renamed); the **flow** must still resolve.

2. **`helm template` the chart and confirm DASHBOARD is gone:**
   ```bash
   helm template supabase/helm/knoe-supabase | grep -i DASHBOARD
   ```
   Expected: no output.

3. **`helm lint`** the chart:
   ```bash
   helm lint supabase/helm/knoe-supabase
   ```
   Expected: clean.

4. **No stale references in the rest of the repo:**
   ```bash
   grep -rni DASHBOARD_USERNAME supabase/ k8s/ deploy/ etc/
   grep -rni DASHBOARD_PASSWORD supabase/ k8s/ deploy/ etc/
   ```
   Expected: no output (or only docs explaining the old flow that you
   then update / remove).

5. **OpenAI key still works in Studio**: hard to verify without rolling
   out, but a `helm template` showing the env var still bound is
   sufficient for chart correctness. Live re-roll of supabase-studio is
   out of scope; flag it as a manual follow-up if anything changes about
   the secret name.

## 5. Out of scope

- **Don't roll out the chart change to live `knoe-dev-0`.** Chart
  cleanup is code-only; the current live deployment uses the OLD chart
  (with `secret.dashboard`), and migrating production secret structure
  is a separate decision.
- The Studio fork (queue item #12) — totally separate.
- Any other Kong route changes — leave the file alone outside the
  surgical lines listed.

## 6. Commit shape

If Path A:

```
chore(supabase): remove dead DASHBOARD consumer + basic-auth credentials

The basic-auth plugin was retired in commit 25f1b2e (oauth2-proxy
took over Studio gating via Google OAuth). Three artifacts of the
old gate remained as no-op config:

  - Kong consumer named DASHBOARD
  - basicauth_credentials block
  - DASHBOARD_USERNAME / DASHBOARD_PASSWORD env in kong deployment

All removed.

The secret.dashboard.openAiApiKey field — the only LIVE consumer
of secret.dashboard — was migrated to secret.openai.apiKey. Studio's
OPENAI_API_KEY env binding updated; helm template diff confirms
the same Secret-source flow.

Closes queue item #15 in docs/TODO.md.
```

If Path B: simpler subject — `chore(supabase): drop dead DASHBOARD username/password`.

## 7. Definition of done

- [ ] Four artifacts removed from `kong/config.yaml`,
  `kong/deployment.yaml`, `values.yaml`, `ci/example.yaml`.
- [ ] OpenAI key still resolves through `helm template`.
- [ ] `helm lint` clean.
- [ ] `grep -rni DASHBOARD_USERNAME` returns nothing in repo.
- [ ] `docs/TODO.md` queue item #15 archived to **Done**.